« Back to Glossary Index
System Monitor (Sysmon) is one of the most commonly used add-ons for Windows logging. With Sysmon, you can detect malicious activity by tracking code behavior and network traffic, as well as create detections based on the malicious activity.
Sysmon is part of the Sysinternals software package, now owned by Microsoft and enriches the standard Windows logs by producing some higher level monitoring of events such as proces creations, network connections and changes to the file system. It is extremely easy to install and deploy.
Following these steps will turn on an incredible amount of logging: How to Enable Sysmon for Windows Logging and Security
« Back to Glossary Index